Files
calendar/packages/features/users/components/UserTable/EditSheet/EditUserSheet.tsx
T
sean-brydonandGitHub 2a7c6590a3 feat: add permission for editUsers + implement UI (#25402)
## What does this PR do?
This PR implements attributes PBAC - router checks + UI

## Visual Demo (For contributors especially)

A visual demonstration is strongly recommended, for both the original and new change **(video / image - any one)**.

#### Video Demo (if applicable):

- Show screen recordings of the issue or feature.
- Demonstrate how to reproduce the issue, the behavior before and after the change.

#### Image Demo (if applicable):

- Add side-by-side screenshots of the original and updated change.
- Highlight any significant change(s).

## Mandatory Tasks (DO NOT REMOVE)

- [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox.
- [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.

## How should this be tested?
Enable PBAC on an org 
Create a custom role -> advanced -> organizations -> "editUser" 
Assign it to a user
impersonate user
test they have access to all things attributes
remove permissions
check they dont have permissions. 

## Checklist

<!-- Remove bullet points below that don't apply to you -->

- I haven't read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
- My code doesn't follow the style guidelines of this project
- I haven't commented my code, particularly in hard-to-understand areas
- I haven't checked if my changes generate no new warnings










<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a new PBAC “editUsers” permission and read gating for Attributes, updating the UI and backend so users can view and edit attributes only when allowed.

- **New Features**
  - Added CustomAction.EditUsers to the permission registry for organization-scoped attribute editing.
  - Settings computes canViewAttributes and shows the Attributes tab only when allowed.
  - Members page fetches Attributes permissions and exposes canViewAttributes and canEditAttributesForUser to the UI.
  - User Edit Sheet hides attributes without read permission and shows attribute editing and the bulk “Mass Assign Attributes” action only with editUsers; other user edits depend on changeMemberRole.
  - Attributes TRPC router gates create/edit/delete/toggle via PBAC and requires organization.attributes.editUsers for assign/bulk-assign; added a helper to create PBAC-aware procedures.

- **Migration**
  - Run the new Prisma migration to seed the admin role with editUsers.
  - If using custom roles, grant Edit Users under Attributes as needed.

<sup>Written for commit 856aa2e8e1521fc22cd71cb0fa6d720036efe8a2. Summary will update automatically on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
2025-11-26 13:58:29 +00:00

164 lines
6.5 KiB
TypeScript

import type { Dispatch } from "react";
import { shallow } from "zustand/shallow";
import { useOrgBranding } from "@calcom/ee/organizations/context/provider";
import { WEBAPP_URL } from "@calcom/lib/constants";
import { useLocale } from "@calcom/lib/hooks/useLocale";
import { trpc } from "@calcom/trpc/react";
import { Avatar } from "@calcom/ui/components/avatar";
import { Sheet, SheetContent, SheetBody, SheetHeader, SheetFooter } from "@calcom/ui/components/sheet";
import { Loader } from "@calcom/ui/components/skeleton";
import type { UserTableAction, UserTableState } from "../types";
import { DisplayInfo } from "./DisplayInfo";
import { EditForm } from "./EditUserForm";
import { OrganizationBanner } from "./OrganizationBanner";
import { SheetFooterControls } from "./SheetFooterControls";
import { useEditMode } from "./store";
function removeProtocol(url: string) {
return url.replace(/^(https?:\/\/)/, "");
}
export function EditUserSheet({
state,
dispatch,
canViewAttributes,
canEditAttributesForUser,
canChangeMemberRole,
}: {
state: UserTableState;
dispatch: Dispatch<UserTableAction>;
canViewAttributes?: boolean;
canEditAttributesForUser?: boolean;
canChangeMemberRole?: boolean;
}) {
const { t } = useLocale();
const { user: selectedUser } = state.editSheet;
const orgBranding = useOrgBranding();
const [editMode, setEditMode] = useEditMode((state) => [state.editMode, state.setEditMode], shallow);
const { data: loadedUser, isPending } = trpc.viewer.organizations.getUser.useQuery(
{
userId: selectedUser?.id,
},
{
enabled: !!selectedUser?.id,
}
);
const { data: usersAttributes, isPending: usersAttributesPending } =
trpc.viewer.attributes.getByUserId.useQuery(
{
// @ts-expect-error We know it exists as it is only called when selectedUser is defined
userId: selectedUser?.id,
},
{
enabled: !!selectedUser?.id && !!canViewAttributes,
}
);
const avatarURL = `${orgBranding?.fullDomain ?? WEBAPP_URL}/${loadedUser?.username}/avatar.png`;
const schedulesNames = loadedUser?.schedules && loadedUser?.schedules.map((s) => s.name);
const teamNames =
loadedUser?.teams && loadedUser?.teams.map((t) => `${t.name} ${!t.accepted ? "(pending)" : ""}`);
return (
<Sheet
open={true}
onOpenChange={() => {
setEditMode(false);
dispatch({ type: "CLOSE_MODAL" });
}}>
<SheetContent className="bg-default">
{!isPending && loadedUser ? (
<>
{!editMode ? (
<>
<SheetHeader showCloseButton={false} className="w-full">
<div className="border-sublte bg-default w-full rounded-xl border p-4">
<OrganizationBanner />
<div className="bg-default ml-3 w-fit translate-y-[-50%] rounded-full p-1 ring-1 ring-[#0000000F]">
<Avatar asChild size="lg" alt={`${loadedUser?.name} avatar`} imageSrc={avatarURL} />
</div>
<h2 className="text-emphasis font-sans text-2xl font-semibold">
{loadedUser?.name || "Nameless User"}
</h2>
<p className="text-subtle max-h-[3em] overflow-hidden text-ellipsis text-sm font-normal">
{loadedUser?.bio || "This user does not have a bio..."}
</p>
</div>
</SheetHeader>
<SheetBody className="stack-y-4 flex flex-col p-4">
<div className="stack-y-4 mb-4 flex flex-col">
<h3 className="text-emphasis mb-1 text-base font-semibold">{t("profile")}</h3>
<DisplayInfo
label="Cal"
value={removeProtocol(
`${orgBranding?.fullDomain ?? WEBAPP_URL}/${loadedUser?.username}`
)}
icon="external-link"
/>
<DisplayInfo label={t("email")} value={loadedUser?.email ?? ""} icon="at-sign" />
<DisplayInfo label={t("role")} value={[loadedUser?.role ?? ""]} icon="fingerprint" />
<DisplayInfo label={t("timezone")} value={loadedUser?.timeZone ?? ""} icon="clock" />
<DisplayInfo
label={t("teams")}
value={!teamNames || teamNames.length === 0 ? "" : teamNames}
icon="users"
coloredBadges
/>
<DisplayInfo
label={t("availability")}
value={!schedulesNames || schedulesNames.length === 0 ? "" : schedulesNames}
icon="calendar"
/>
</div>
{canViewAttributes && usersAttributes && usersAttributes?.length > 0 && (
<div className="mt-4 flex flex-col">
<h3 className="text-emphasis mb-5 text-base font-semibold">{t("attributes")}</h3>
<div className="stack-y-4 flex flex-col">
{usersAttributes.map((attribute, index) => (
<>
<DisplayInfo
key={index}
label={attribute.name}
value={
["TEXT", "NUMBER", "SINGLE_SELECT"].includes(attribute.type)
? attribute.options[0].value
: attribute.options.map((option) => option.value)
}
/>
</>
))}
</div>
</div>
)}
</SheetBody>
<SheetFooter>
<SheetFooterControls
canEditAttributesForUser={canEditAttributesForUser}
canChangeMemberRole={canChangeMemberRole}
/>
</SheetFooter>
</>
) : (
<>
<EditForm
selectedUser={loadedUser}
avatarUrl={loadedUser.avatarUrl ?? avatarURL}
domainUrl={orgBranding?.fullDomain ?? WEBAPP_URL}
dispatch={dispatch}
canEditAttributesForUser={canEditAttributesForUser}
/>
</>
)}
</>
) : (
<Loader />
)}
</SheetContent>
</Sheet>
);
}